Which protective headers a page sends, which are missing, and what each one does.
The address is fetched exactly as given. Without a scheme, https is assumed. A path is kept, because an application often sends headers its marketing pages do not.
This check needs JavaScript. With it switched off, this tool cannot be used; the text tools on this site still work.